SAR tests

Make a full test suite for SAR that covers these with both the current and the backwards compatible endpoints.

Personal LSAR -> allowed by local personal LSAR binding
Personal LSAR -> allowed by global personal LSAR binding
Personal LSAR -> denied by missing LSAR binding

Personal SAR without action.namespace -> allowed by global personal SAR binding
Personal SAR without action.namespace -> denied by missing SAR binding

Personal SAR with action.namespace -> allowed by global personal SAR binding and global personal LSAR binding
Personal SAR with action.namespace -> allowed by global personal SAR binding and local personal LSAR binding
Personal SAR with action.namespace -> denied by global personal SAR binding and missing LSAR binding
Personal SAR with action.namespace -> denied by missing SAR binding

Impersonal LSAR -> allowed by local LSAR binding
Impersonal LSAR -> allowed by global LSAR binding
Impersonal LSAR -> denied by local personal LSAR binding
Impersonal LSAR -> denied by global personal LSAR binding
Impersonal LSAR -> denied by missing LSAR binding

Impersonal SAR without action.namespace -> allowed by global SAR binding
Impersonal SAR without action.namespace -> denied by global personal SAR binding
Impersonal SAR without action.namespace -> denied by missing SAR binding

Impersonal SAR with action.namespace -> allowed by global SAR binding and global LSAR binding
Impersonal SAR with action.namespace -> allowed by global SAR binding and local LSAR binding
Impersonal SAR with action.namespace -> denied by global SAR binding and personal LSAR binding
Impersonal SAR with action.namespace -> denied by global personal SAR binding and LSAR binding
Impersonal SAR with action.namespace -> denied by global SAR binding and missing LSAR binding
Impersonal SAR with action.namespace -> denied by missing SAR binding

The issue names no files, tests, or entry points. Start by locating the existing SAR and LSAR tests and their current and backwards-compatible endpoints, then compare coverage with the listed personal and impersonal binding cases; done means every listed allow and deny scenario is covered for both endpoint versions.